Reader James ran into a Fake AV ad delivered by Double click. It is not clear if this is the result of a compromise of double click, or a paid ad that slipped through doubleclick's content review process. James' started out at a local new paper web site, that like many others features ads served by double click. Luckily, James used a proxy tool (Fiddler) to record the session. Here are some of the excerpts (slightly anonymized and spaces inserted to avoid accidental clicks):

The content starts very similar, but his copy included additional javascript, forwarding the user to 'fav ozek.info' . The domain is somewhat new (October 12 2012) and registered with Privacyprotect.org. Right now, none of the domains is listed as malicious in virustotal.

Still digging deeper into this, but right now, this looks at least suspicious. Let me know if you see similar issues with double click ads.

In this case, the attacker is '2.139.216.153'. According to our DShield data, the host has a history of port 25 scanning, and evidently, participates in these brute force attacks once it finds port 25 open. (see https://isc.sans.edu/ipdetails.html?ip=2.139.216.153 ).

But this is just one of many IPs that Pete sees coming into his network. They all use "192.168.2.33" as hostname, which appears to be hard coded into the bot used to produce these scans.

enable rate limits for inbound authentication attempts. This will at least slow down the attack. (consult your mail servers manual for details. Each server is different)

enable reasonable rate limits for outbound email. This way, it is easier to detect compromised accounts, and the account is of less value to the spammer

do not rely on passwords. Use SSL client certificates (or at least enforce a strong password policy)

only allow connections to send mail from inside your network, or via a VPN.

Any other ideas? FWIW: I do not recommend strict "lock out" policies for mail servers. They can make it impossible to change your SMTP password. Many users will use multiple devices these days, and if you for example lock an account after 3 bad logins, a user changing a password will be locked out as the users cell phone / tablet will continue to use the old password until it is changed. If you do implement lock out, then please communicate this to your users and ask them to first turn off all devices (that can be challenging as they may not even remember which devices they have) and then change their password.